An abnormality positioning method, apparatus, device, and storage medium

Abstract

The application discloses an abnormal positioning method, device and equipment and a storage medium, and comprises the following steps: acquiring an abnormal request parameter and at least one alternative dimension associated with the abnormal request parameter; counting abnormal data of the abnormal request parameter under each alternative dimension, and determining an instantaneous change rate fluctuation value of the abnormal request parameter under each alternative dimension; according to the instantaneous change rate fluctuation value under each alternative dimension, performing combination screening on each alternative dimension to obtain a dimension combination; calculating the influence degree of the alternative dimensions included in the dimension combination on the abnormal request parameter, and screening out a target dimension. According to the application, the multiple alternative dimensions associated with the abnormal request parameter are combined and screened to obtain a dimension combination, so that the time for analyzing the abnormal request parameter is saved; meanwhile, the alternative dimensions in the dimension combination are further analyzed, so that the granularity of analyzing the abnormal request parameter is more detailed, and therefore the efficiency and accuracy of abnormal positioning are improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an anomaly location method, apparatus, device, and storage medium. Background Technology

[0002] With the development of the internet industry, application architectures are becoming increasingly complex. For a large enterprise's services, different nodes, various services, and networks generate a large number of alerts every day. Currently, most methods rely on manual identification or manual viewing of abnormal indicator changes in a certain dimension to locate the anomalies causing the alerts.

[0003] Faced with a large number of alerts, operations and maintenance personnel often struggle to quickly extract truly useful information. Alternatively, they may analyze only a single aspect, lacking sufficient granularity and accurate localization, making it difficult to pinpoint the specific anomaly causing the alerts and hindering service recovery. This can potentially impact the secure operation of other services, leading to losses. Summary of the Invention

[0004] This invention provides an anomaly location method, apparatus, device, and storage medium to improve the efficiency and accuracy of anomaly location.

[0005] According to one aspect of the present invention, an anomaly localization method is provided, comprising:

[0006] Obtain the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters;

[0007] Statistically analyze the abnormal data of abnormal request parameters under each alternative dimension, and determine the instantaneous rate of change fluctuation of abnormal request parameters under each alternative dimension;

[0008] Based on the instantaneous rate of change fluctuation value under each candidate dimension, the candidate dimensions are combined and screened to obtain the dimension combination;

[0009] The calculation of the impact of the candidate dimensions included in the dimension combination on the abnormal request parameters is performed, and the target dimension is selected.

[0010] According to another aspect of the present invention, an anomaly location device is provided, comprising:

[0011] The parameter and dimension acquisition module is used to acquire abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters;

[0012] The fluctuation value determination module is used to statistically analyze the abnormal data of abnormal request parameters under each alternative dimension, and to determine the instantaneous rate of change fluctuation value of abnormal request parameters under each alternative dimension.

[0013] The dimension combination determination module is used to combine and filter the candidate dimensions based on the instantaneous rate of change fluctuation value of each candidate dimension to obtain the dimension combination.

[0014] The target dimension filtering module is used to calculate the impact of the candidate dimensions included in the dimension combination on the abnormal request parameters, and to filter out the target dimensions.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory that is communicatively connected to at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the anomaly localization method of any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the anomaly location method of any embodiment of the present invention.

[0020] The technical solution of this invention involves obtaining abnormal request parameters and at least one candidate dimension associated with them; statistically analyzing the abnormal data of the abnormal request parameters under each candidate dimension, and determining the instantaneous rate of change fluctuation value of the abnormal request parameters under each candidate dimension; combining and filtering the candidate dimensions based on the instantaneous rate of change fluctuation value of each candidate dimension to obtain a dimension combination; calculating the influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and selecting the target dimension. This technical solution combines and filters multiple candidate dimensions associated with the abnormal request parameters to obtain a dimension combination, saving time in analyzing the abnormal request parameters; simultaneously, further analysis of the candidate dimensions in the dimension combination makes the granularity of the abnormal request parameter analysis more refined, thereby improving the efficiency and accuracy of anomaly localization.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of an anomaly localization method provided according to Embodiment 1 of the present invention;

[0024] Figure 2A This is a flowchart of an anomaly localization method provided according to Embodiment 2 of the present invention;

[0025] Figure 2B This is a scenario diagram of a method for eliminating alternative combinations according to Embodiment 2 of the present invention;

[0026] Figure 2C This is a schematic diagram of a method for characterizing the influence of alternative dimensions included in a dimension combination on abnormal request parameters according to Embodiment 2 of the present invention;

[0027] Figure 3 This is a flowchart of an anomaly localization method provided according to Embodiment 3 of the present invention;

[0028] Figure 4 This is a schematic diagram of an anomaly location device according to Embodiment 4 of the present invention;

[0029] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the anomaly localization method of this invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "objective," "first," "second," and "third," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] Example 1

[0033] Figure 1 This is a flowchart of an anomaly localization method provided in Embodiment 1 of the present invention. This embodiment is applicable to the localization of anomalies causing failures in complex systems. The method can be executed by an anomaly localization device, which can be implemented in hardware and / or software and configured in an electronic device, such as a server. Figure 1 As shown, the method includes:

[0034] S101. Obtain the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters.

[0035] The abnormal request parameters can refer to parameters associated with the occurrence of an abnormal alarm event. Optionally, the abnormal request parameters can be parameters of the network request associated with the abnormal alarm event, such as the network request's response time, error rate, throughput, CPU utilization, and memory utilization. The above operations can locate anomalies caused by network requests, thereby enabling targeted handling of abnormal alarm events caused by network requests and improving the efficiency of abnormal alarm event processing.

[0036] Here, alternative dimensions can refer to factors that influence abnormal request parameters. For example, if factors affecting network request throughput include the server, the data type of the network request, and the current number of users, then the corresponding alternative dimensions for network request throughput include server dimension, network request data type dimension, and current number of users dimension. Similarly, if factors affecting network request response time include region and carrier, then the corresponding alternative dimensions for network request response time include region dimension and carrier dimension.

[0037] Specifically, the abnormal request parameters of the network request corresponding to the abnormal alarm information are obtained, and the abnormal request parameters are detected to obtain at least one alternative dimension associated with the abnormal request parameters.

[0038] It should be noted that abnormal alarm information can be collected by data acquisition devices and stored in preset data storage devices. The preset data storage device can be a regular relational database or a time-series database; there are no restrictions on the preset data storage device.

[0039] S102. Statistically analyze the abnormal data of abnormal request parameters under each alternative dimension, and determine the instantaneous rate of change fluctuation value of abnormal request parameters under each alternative dimension.

[0040] Here, abnormal data can refer to the parameter values ​​of abnormal request parameters under the alternative dimensions. The instantaneous rate of change fluctuation value reflects the change of the parameter values ​​of abnormal request parameters under the alternative dimensions within a fixed time period. The instantaneous rate of change reflects the change of the parameter values ​​of abnormal request parameters under the alternative dimensions at a specific moment. The fixed time period includes at least one moment and can be preset. For each alternative dimension, the instantaneous rate of change of the abnormal request parameter under the alternative dimension can be expressed by the following formula:

[0041]

[0042] Where δ represents the instantaneous rate of change of the abnormal request parameters under the alternative dimensions, a i This represents the parameter value of the abnormal request parameter under the alternative dimension at the current moment, a. i-1 This represents the parameter value of the exception request parameter in the candidate dimension at the current time. Where i represents the current time, i-1 represents the previous time, i = 1, 2, ..., n, and n is a positive integer.

[0043] Specifically, for each candidate dimension, abnormal data of abnormal request parameters under the candidate dimension are statistically analyzed within a fixed time period, and the instantaneous change rate of abnormal request parameters under the candidate dimension at multiple moments within the fixed time period is calculated; based on the instantaneous change rate of abnormal request parameters under the candidate dimension, the fluctuation value of the instantaneous change rate of abnormal request parameters under the candidate dimension within the fixed time period is determined.

[0044] For example, for each candidate dimension, the abnormal data of abnormal request parameters under the candidate dimension in the last 3 minutes are counted; the instantaneous change rate of abnormal request parameters under the candidate dimension is calculated every 1 minute to obtain 3 instantaneous change rates of abnormal request parameters under the candidate dimension; the average of these 3 instantaneous change rates is calculated and these averages are used as the fluctuation value of the instantaneous change rate of abnormal request parameters under the candidate dimension.

[0045] Optionally, within the target time period, detect the instantaneous change rate of abnormal request parameters under each alternative dimension in multiple unit time periods. The target time period includes multiple unit time periods. For each alternative dimension, calculate the variance of the instantaneous change rate in each unit time period to obtain the instantaneous change rate fluctuation value under the alternative dimension.

[0046] The target time period includes at least one unit time period, which can be preset and is generally the time period 5 minutes immediately preceding the current time. For example, if the current time is i, where i is a positive integer, then the target time period is the time period from time i-4 to time i. A unit time period can refer to the time period between two adjacent times, which can be obtained by dividing the target time period. For instance, if the target time period is the time period 5 minutes immediately preceding the current time, dividing the target time period every minute results in 5 unit time periods. It should be noted that the rules for dividing the target time period can be set according to user needs and are not specifically limited.

[0047] Specifically, for each candidate dimension, within each unit time period of the target time period, the instantaneous change rate of the abnormal request parameter at any randomly selected moment within the unit time period is calculated according to the aforementioned formula for calculating the instantaneous change rate. This yields at least one instantaneous change rate for each candidate dimension within the target time period. The variance of these instantaneous change rates is then calculated and used as the fluctuation value of the instantaneous change rate of the abnormal request parameter under the candidate dimension. For each candidate dimension, the fluctuation value (i.e., variance) of the instantaneous change rate of the abnormal request parameter under the candidate dimension can be expressed by the following formula:

[0048]

[0049] Among them, s 2 This represents the variance of the instantaneous rate of change of abnormal request parameters under the candidate dimensions within the target time period, i.e., the fluctuation value of the instantaneous rate of change of abnormal request parameters under the candidate dimensions, δ. i This represents the instantaneous rate of change of the abnormal request parameters under the candidate dimensions within the i-th unit time period, where i = 1, 2, ..., n, and n is a positive integer. This represents the average instantaneous rate of change of abnormal request parameters across alternative dimensions within the target time period.

[0050] The above operation provides a method for determining the instantaneous rate of change fluctuation of abnormal request parameters under each alternative dimension, which can more accurately reflect the changes of abnormal request parameters under each alternative dimension.

[0051] S103. Based on the instantaneous rate of change fluctuation value under each candidate dimension, combine and screen each candidate dimension to obtain a dimension combination.

[0052] Here, a dimension combination can refer to a combination consisting of at least one alternative dimension associated with the abnormal request parameters. One approach is to first combine at least one alternative dimension to generate at least one alternative combination, and then filter the alternative combinations to obtain the dimension combination; or one approach is to first filter at least one alternative dimension, and then combine the filtered alternative dimensions to obtain the dimension combination.

[0053] For example, based on the instantaneous rate of change fluctuation of the abnormal request parameters under each alternative dimension, the alternative dimensions are randomly combined to obtain at least one alternative combination; these alternative combinations are then randomly selected to obtain at least one dimension combination.

[0054] For example, the instantaneous rate of change fluctuation values ​​of abnormal request parameters under the candidate dimensions are sorted from largest to smallest. The candidate dimensions are divided into two categories equally or approximately according to the number of candidate dimensions. The instantaneous rate of change fluctuation value of abnormal request parameters under the first category of candidate dimensions is smaller than the instantaneous rate of change fluctuation value of abnormal request parameters under the second category of candidate dimensions. Then, the second category of candidate dimensions are combined to obtain the dimension combination.

[0055] S104. Calculate the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and select the target dimension.

[0056] The degree of influence reflects the importance of the candidate dimensions included in the dimension combination to the abnormal request parameters. The greater the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, the more important the candidate dimension is to the abnormal request parameters. The target dimension can refer to the dimension obtained after filtering the candidate dimensions included in the dimension combination.

[0057] For example, calculate the maximum instantaneous rate of change of the abnormal request parameters under the alternative dimensions included in the dimension combination; and use the alternative dimension corresponding to the maximum value as the target dimension.

[0058] For example, the average instantaneous change rate of the abnormal request parameter under the candidate dimensions included in the dimension combination is calculated. The instantaneous change rate of the abnormal request parameter under each candidate dimension included in the dimension combination is compared with the average value to obtain the candidate dimensions under the dimension combination for all abnormal request parameters whose instantaneous change rate is greater than the average value. The maximum instantaneous change rate of the abnormal request parameter under these candidate dimensions is calculated. The candidate dimension corresponding to the maximum value is taken as the target dimension.

[0059] The technical solution of this invention involves obtaining abnormal request parameters and at least one candidate dimension associated with them; statistically analyzing the abnormal data of the abnormal request parameters under each candidate dimension, and determining the instantaneous rate of change fluctuation value of the abnormal request parameters under each candidate dimension; combining and filtering the candidate dimensions based on the instantaneous rate of change fluctuation value of each candidate dimension to obtain a dimension combination; calculating the influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and selecting the target dimension. This technical solution combines and filters multiple candidate dimensions associated with the abnormal request parameters to obtain a dimension combination, saving time in analyzing the abnormal request parameters; simultaneously, further analysis of the candidate dimensions in the dimension combination makes the granularity of the abnormal request parameter analysis more refined, thereby improving the efficiency and accuracy of anomaly localization.

[0060] Example 2

[0061] Figure 2A This is a flowchart of an anomaly localization method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment further refines the step of "combining and filtering each candidate dimension according to the instantaneous rate of change fluctuation value under each candidate dimension to obtain a dimension combination" to: "combining each candidate dimension according to the level corresponding to each candidate dimension to obtain at least one candidate combination; wherein, the candidate combination includes one candidate dimension at the same level; when the instantaneous rate of change fluctuation value of the anomaly request parameter under the candidate combination is greater than or equal to the fluctuation threshold, the candidate combination is determined as a dimension combination," providing an optional implementation scheme. It should be noted that parts not detailed in this embodiment can be referred to in the relevant descriptions of other embodiments. For example... Figure 2A As shown, the method includes:

[0062] S201. Obtain the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters.

[0063] S202. Statistically analyze the abnormal data of abnormal request parameters under each alternative dimension, and determine the instantaneous rate of change fluctuation value of abnormal request parameters under each alternative dimension.

[0064] S203. Based on the level corresponding to each candidate dimension, combine each candidate dimension to obtain at least one candidate combination; wherein, the number of candidate dimensions at the same level in the candidate combination is one.

[0065] The hierarchy is used to divide the candidate dimensions. A hierarchy can refer to the category information obtained by dividing the candidate dimensions. For example, the hierarchy is "region," and the candidate dimensions for this hierarchy are Region A, Region B, and Region C. These can be pre-defined, such as dividing the candidate dimensions into first, second, and third dimensions. A candidate combination refers to a combination obtained by combining candidate dimensions. For each hierarchy, one candidate dimension is selected, and candidate dimensions from different hierarchies are combined to obtain a candidate combination. A candidate combination must not contain at least two candidate dimensions from the same hierarchy. For example, if Region A, Region B, and Region C are three candidate dimensions from the same hierarchy, then a candidate combination can only include one of Region A, Region B, and Region C.

[0066] Specifically, the alternative dimensions can be combined according to the tree structure based on the preset hierarchy of the alternative dimensions, with the abnormal request parameters set as the root node of the tree structure and the alternative dimensions as child nodes of the tree structure; the alternative combinations are determined based on the tree structure formed by the alternative dimensions.

[0067] For example, such as Figure 2B As shown, the abnormal request parameter is the network request response time, and its associated alternative dimensions include the region dimension and the carrier dimension. According to the hierarchy corresponding to the preset alternative dimensions, the alternative dimensions are combined in a tree structure, with the network request response time set as the root node of the tree structure, the region dimension set as the first dimension, and the carrier dimension set as the second dimension. Each first dimension can be associated with at least one second dimension, and the second dimensions associated with multiple first dimensions can overlap. Figure 2B In this context, the first dimension includes three alternative dimensions: region A, region B, and region C. Region A is associated with three second dimensions: operator a, operator b, and operator c; region B is associated with two second dimensions: operator c and operator d; and region C is associated with two second dimensions: operator d and operator e. Based on the number of alternative dimensions in the first dimension (3), the number of alternative combinations is determined, with one alternative combination corresponding to one first dimension. Therefore, three alternative combinations are determined: alternative combination 1 (denoted as BX1), alternative combination 2 (denoted as BX2), and alternative combination 3 (denoted as BX3).

[0068] S204. When the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is greater than or equal to the fluctuation threshold, the alternative combination is determined as the dimension combination.

[0069] The fluctuation threshold is used to filter dimensional combinations. It can be set manually based on experience, or it can be obtained by training on abnormal data in real time using machine learning algorithms. This allows for automatic adjustment of the fluctuation threshold based on abnormal data without human intervention. A dimensional combination refers to the combination obtained after filtering candidate combinations. There must be at least one dimensional combination.

[0070] Based on the above example, still using Figure 2B For example, the abnormal request parameter is the network request response time. If the instantaneous rate of change fluctuation of the network request response time under BX1 is less than the fluctuation threshold, the instantaneous rate of change fluctuation of the network request response time under BX2 is equal to the fluctuation threshold, and the instantaneous rate of change fluctuation of the network request response time under BX3 is greater than the fluctuation threshold, then BX2 and BX3 are determined as the dimension combination.

[0071] Optionally, if the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is less than the fluctuation threshold, a pruning operation is performed on the alternative combination.

[0072] The pruning operation is used to filter out candidate combinations where the instantaneous rate of change fluctuation of abnormal request parameters is less than the fluctuation threshold, in order to complete the screening of candidate combinations.

[0073] Based on the above example, still using Figure 2B For example, if the instantaneous rate of change of network request response time under BX1 is less than the fluctuation threshold, a pruning operation is performed on BX1, and the alternative dimensions under BX1 will no longer be analyzed.

[0074] The above operations reduce the number of times alternative combinations need to be judged, save the analysis time of alternative dimensions associated with abnormal request parameters, and thus improve the efficiency of anomaly localization.

[0075] S205. Calculate the impact of the alternative dimensions included in the dimension combination on the abnormal request parameters, and select the target dimension.

[0076] Optionally, obtain the instantaneous change rate of each candidate dimension included in the dimension combination within the same time period, and determine the average change rate of the dimension combination; based on the average change rate of the dimension combination, calculate the degree of deviation of the change rate of each candidate dimension included in the dimension combination, determine the degree of influence of each candidate dimension included in the dimension combination on the abnormal request parameters, and filter out the target dimension.

[0077] The average rate of change is used to filter target dimensions and can be obtained by calculating the average of the instantaneous rates of change of the candidate dimensions included in the dimension combination over the same time period. The degree of deviation of the rate of change of the candidate dimensions included in the dimension combination can be obtained by comparing the instantaneous rate of change of the candidate dimensions included in the dimension combination with the average rate of change over the same time period. For example, the degree of deviation of the rate of change of the candidate dimensions included in the dimension combination is equal to the absolute value of the difference between the instantaneous rate of change of the candidate dimensions included in the dimension combination and the average rate of change over the same time period.

[0078] Specifically, for each dimension combination, within a preset time period, the instantaneous change rate of the abnormal request parameters under the candidate dimensions included in the dimension combination is obtained, and the average of these instantaneous change rates is calculated, which is then used as the average change rate of the dimension combination. The difference between the instantaneous change rate of the candidate dimensions included in the dimension combination and this average change rate is calculated, and the absolute value of these differences is used as the deviation degree of the change rate of the candidate dimensions included in the dimension combination. These deviation degrees are then sorted from largest to smallest, and the target dimension is selected based on the sorting results. Optionally, the candidate dimension with the largest deviation degree of change rate is determined as the target dimension.

[0079] The above operations provide a method for determining the degree of influence of alternative dimensions included in the dimension combination on abnormal request parameters, and a method for determining the target dimension, thereby quickly locating the dimension of the abnormal request parameter that caused the abnormality and improving the accuracy of abnormality location.

[0080] Optionally, statistical functions can be used to characterize the influence of each alternative dimension included in the dimension combination on the abnormal request parameters, and the target dimension can be selected.

[0081] Specifically, such as Figure 2C As shown, for each dimension combination, the deviation of the rate of change of each candidate dimension included in the dimension combination is used as the input of the Tanh function to calculate the score of the influence of each candidate dimension included in the dimension combination on the abnormal request parameters. It should be noted that the upper limit of the Tanh function is 1 and the lower limit is -1, and only the deviation of the rate of change with a score in the range [0,1) is extracted. A score of 0 indicates that the candidate dimension with that rate of change deviation has no influence on the abnormal request parameters. The closer the score is to 1, the greater the influence of the candidate dimension with that rate of change deviation on the abnormal request parameters. The candidate dimension with the rate of change deviation whose score is closest to 1 is selected as the target dimension.

[0082] The above operations can intuitively reflect the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and provide a criterion for judging the score of the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters. The closer the score is to 1, the greater the degree of influence of the candidate dimension with the degree of deviation of the rate of change on the abnormal request parameters, thereby quickly filtering out the target dimension.

[0083] The technical solution of this invention combines each candidate dimension according to the level corresponding to each candidate dimension to obtain at least one candidate combination; when the instantaneous rate of change fluctuation of the abnormal request parameter under the candidate combination is greater than or equal to the fluctuation threshold, the candidate combination is determined as a dimension combination. This provides a method for determining dimension combinations, facilitating further analysis of the candidate dimensions associated with the abnormal request parameter. It retains only the candidate dimensions on which the abnormal request parameter changes significantly, reducing analysis time and thus improving the efficiency of anomaly localization.

[0084] Furthermore, the acquired target dimensions can be stored to persist the anomaly localization results; they can also be displayed visually to operations and maintenance personnel to help them quickly locate anomalies and handle them in a targeted manner. It should be noted that the anomaly localization results can be output in various ways, including but not limited to storing them in a database or directly outputting the results via a message queue.

[0085] Example 3

[0086] Based on the above technical solutions, the present invention also provides a preferred embodiment. It should be noted that parts not described in detail in the embodiments of the present invention can be referred to the relevant descriptions in other embodiments. See also... Figure 3 The flowchart of the anomaly localization method shown includes:

[0087] S301. Obtain the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters.

[0088] S302. Within the target time period, detect the instantaneous change rate of abnormal request parameters under each alternative dimension in multiple unit time periods. The target time period includes multiple unit time periods.

[0089] The target time period includes at least one unit time period, which can be preset and is generally the time period 5 minutes immediately preceding the current time. For example, if the current time is i, where i is a positive integer, then the target time period is the time period from time i-4 to time i. A unit time period can refer to the time period between two adjacent times, which can be obtained by dividing the target time period. For instance, if the target time period is the time period 5 minutes immediately preceding the current time, dividing the target time period every minute results in 5 unit time periods. It should be noted that the rules for dividing the target time period can be set according to user needs and are not specifically limited.

[0090] Specifically, for each candidate dimension, within each unit time period of the target time period, the instantaneous change rate of the abnormal request parameter at any randomly selected moment within the unit time period is calculated according to the aforementioned formula for calculating the instantaneous change rate. The data platform system is used to provide faster services for various business operations.

[0091] S303. For each candidate dimension, calculate the variance of the instantaneous rate of change for each unit time period to obtain the fluctuation value of the instantaneous rate of change under the candidate dimension.

[0092] Specifically, for each candidate dimension, the instantaneous rate of change (i.e., variance) of the abnormal request parameters under the candidate dimension can be represented by the following formula:

[0093]

[0094] Among them, s 2 This represents the variance of the instantaneous rate of change of abnormal request parameters under the candidate dimensions within the target time period, i.e., the fluctuation value of the instantaneous rate of change of abnormal request parameters under the candidate dimensions, δ. i This represents the instantaneous rate of change of the abnormal request parameters under the candidate dimensions within the i-th unit time period, where i = 1, 2, ..., n, and n is a positive integer. This represents the average instantaneous rate of change of abnormal request parameters across alternative dimensions within the target time period.

[0095] S304. Based on the level corresponding to each candidate dimension, combine each candidate dimension to obtain at least one candidate combination; wherein, the number of candidate dimensions at the same level in the candidate combination is one.

[0096] S305. Determine whether the instantaneous change rate fluctuation value under the candidate dimension is greater than or equal to the fluctuation threshold. If yes, execute S306; otherwise, execute S310.

[0097] S306. When the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is greater than or equal to the fluctuation threshold, the alternative combination is determined as the dimension combination.

[0098] S307. Obtain the instantaneous rate of change of each alternative dimension included in the dimension combination within the same time period, and determine the average rate of change of the dimension combination.

[0099] S308. Based on the average rate of change of the dimension combination, calculate the degree of deviation of the rate of change of each alternative dimension included in the dimension combination, and determine the degree of influence of each alternative dimension included in the dimension combination on the abnormal request parameters.

[0100] S309. The candidate dimension with the largest deviation in rate of change is determined as the target dimension.

[0101] S310. When the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is less than the fluctuation threshold, perform a pruning operation on the alternative combination.

[0102] The technical solution of this invention starts with abnormal request parameters and performs a comprehensive analysis of these parameters from multiple dimensions. When processing massive amounts of data, a combined dimensional analysis method is employed, utilizing pruning operations to quickly extract the dimensions that truly affect the abnormal request parameters from the massive data. This avoids manually sifting through massive amounts of data to find abnormal alarm information, saving labor costs and time. Simultaneously, a more refined analysis of the abnormal request parameters is performed, quickly and accurately locating the anomaly, improving the efficiency and accuracy of anomaly location, preventing further escalation of the anomaly, and reducing losses.

[0103] Example 4

[0104] Figure 4 This is a schematic diagram of an anomaly location device provided in Embodiment 4 of the present invention. This embodiment is applicable to locating anomalies causing failures in complex systems. The device can be implemented in hardware and / or software and can be configured in an electronic device, such as a server. Figure 4 As shown, the device includes:

[0105] The parameter and dimension acquisition module 401 is used to acquire the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters;

[0106] The fluctuation value determination module 402 is used to statistically analyze the abnormal data of the abnormal request parameters under each alternative dimension, and to determine the instantaneous rate of change fluctuation value of the abnormal request parameters under each alternative dimension.

[0107] The dimension combination determination module 403 is used to combine and filter each candidate dimension based on the instantaneous rate of change fluctuation value of each candidate dimension to obtain the dimension combination.

[0108] The target dimension filtering module 404 is used to calculate the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and to filter out the target dimensions.

[0109] The technical solution of this invention includes: a candidate dimension acquisition module to acquire abnormal request parameters and at least one candidate dimension associated with the abnormal request parameters; a fluctuation value determination module to statistically analyze the abnormal data of the abnormal request parameters under each candidate dimension and determine the instantaneous rate of change fluctuation value of the abnormal request parameters under each candidate dimension; a dimension combination determination module to combine and filter each candidate dimension according to the instantaneous rate of change fluctuation value under each candidate dimension to obtain a dimension combination; and a target dimension filtering module to calculate the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters and filter out the target dimension. This technical solution combines and filters multiple candidate dimensions associated with abnormal request parameters to obtain a dimension combination, saving time in analyzing abnormal request parameters. Simultaneously, further analysis of the candidate dimensions in the dimension combination makes the granularity of abnormal request parameter analysis more refined, thereby improving the efficiency and accuracy of anomaly localization.

[0110] Optionally, the dimension combination determination module 403 includes:

[0111] The alternative combination determination unit is used to combine each alternative dimension according to the level corresponding to each alternative dimension to obtain at least one alternative combination; wherein, the number of alternative dimensions at the same level in the alternative combination is one;

[0112] The dimension combination determination unit is used to determine the candidate combination as the dimension combination when the instantaneous rate of change fluctuation of the abnormal request parameters under the candidate combination is greater than or equal to the fluctuation threshold.

[0113] Optionally, the device may further include:

[0114] The alternative combination pruning module is used to perform pruning operations on the alternative combination when the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is less than the fluctuation threshold.

[0115] Optionally, the fluctuation value determination module 402 includes:

[0116] The rate of change detection unit is used to detect the instantaneous rate of change of abnormal request parameters under each alternative dimension in multiple unit time periods within a target time period. The target time period includes multiple unit time periods.

[0117] The fluctuation value determination unit is used to calculate the variance of the instantaneous rate of change for each unit time period for each candidate dimension, and obtain the fluctuation value of the instantaneous rate of change under the candidate dimension.

[0118] Optionally, the target dimension filtering module 404 includes:

[0119] The average rate of change determination unit is used to obtain the instantaneous rate of change of each candidate dimension included in the dimension combination within the same time period, and to determine the average rate of change of the dimension combination.

[0120] The influence degree determination unit is used to calculate the degree of deviation of the change rate of each candidate dimension included in the dimension combination based on the average change rate of the dimension combination, and determine the degree of influence of each candidate dimension included in the dimension combination on the abnormal request parameters.

[0121] Optionally, the filtering of target dimensions is specifically used for:

[0122] The candidate dimension with the largest deviation in rate of change is selected as the target dimension.

[0123] Optionally, the abnormal request parameters are the parameters of the network request associated with the abnormal alarm event.

[0124] The anomaly location device provided in the embodiments of the present invention can execute the anomaly location method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each anomaly location method.

[0125] Example 5

[0126] Figure 5 A schematic diagram of an electronic device 500 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0127] like Figure 5 As shown, the electronic device 500 includes at least one processor 501 and a memory, such as a read-only memory (ROM) 502 or a random access memory (RAM) 503, communicatively connected to the at least one processor 501. The memory stores computer programs executable by the at least one processor. The processor 501 can perform various appropriate actions and processes based on the computer program stored in the ROM 502 or loaded into the RAM 503 from storage unit 508. The RAM 503 can also store various programs and data required for the operation of the electronic device 500. The processor 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0128] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0129] Processor 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 501 performs the various methods and processes described above, such as anomaly localization methods.

[0130] In some embodiments, the anomaly localization method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by processor 501, one or more steps of the anomaly localization method described above may be performed. Alternatively, in other embodiments, processor 501 may be configured to perform the anomaly localization method by any other suitable means (e.g., by means of firmware).

[0131] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0132] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0133] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0134] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0135] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0136] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability.

[0137] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0138] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An anomaly localization method, characterized in that, include: Obtain the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters; Statistically analyze the abnormal data of the abnormal request parameters under each of the candidate dimensions, and determine the instantaneous rate of change fluctuation value of the abnormal request parameters under each of the candidate dimensions; Based on the instantaneous rate of change fluctuation value under each of the candidate dimensions, the candidate dimensions are combined and screened to obtain a dimension combination; Calculate the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and filter out the target dimension; The determination of the instantaneous rate of change fluctuation value of the abnormal request parameter under each of the candidate dimensions includes: For each candidate dimension, calculate the instantaneous rate of change of the abnormal request parameter under that candidate dimension for each unit time period within the target time period; Calculate the variance of the instantaneous change rate of the abnormal request parameter under the alternative dimension within the target time period to obtain the fluctuation value of the instantaneous change rate of the abnormal request parameter under the alternative dimension. The step of combining and filtering the candidate dimensions based on the instantaneous rate of change fluctuation value under each candidate dimension to obtain a dimension combination includes: Based on the level corresponding to each of the candidate dimensions, the candidate dimensions are combined to obtain at least one candidate combination; wherein, the number of candidate dimensions at the same level in the candidate combination is one. When the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is greater than or equal to the fluctuation threshold, the alternative combination is determined as the dimension combination.

2. The method according to claim 1, characterized in that, Also includes: When the instantaneous rate of change fluctuation of the abnormal request parameter under the alternative combination is less than the fluctuation threshold, a pruning operation is performed on the alternative combination.

3. The method according to claim 1, characterized in that, The calculation of the influence of the candidate dimensions included in the dimension combination on the abnormal request parameters includes: Obtain the instantaneous rate of change of each candidate dimension included in the dimension combination within the same time period, and determine the average rate of change of the dimension combination; Based on the average rate of change of the dimension combination, calculate the degree of deviation of the rate of change of each alternative dimension included in the dimension combination, and determine the degree of influence of each alternative dimension included in the dimension combination on the abnormal request parameters.

4. The method according to claim 3, characterized in that, The selected target dimensions include: The candidate dimension with the largest deviation in rate of change is selected as the target dimension.

5. The method according to claim 1, characterized in that, The abnormal request parameters are the parameters of the network request associated with the occurrence of the abnormal alarm event.

6. An anomaly location device, characterized in that, include: The parameter and dimension acquisition module is used to acquire the abnormal request parameters and at least one alternative dimension associated with the abnormal request parameters; The fluctuation value determination module is used to statistically analyze the abnormal data of the abnormal request parameters under each of the candidate dimensions, and determine the instantaneous rate of change fluctuation value of the abnormal request parameters under each of the candidate dimensions. The dimension combination determination module is used to combine and filter the candidate dimensions based on the instantaneous rate of change fluctuation value of each candidate dimension to obtain the dimension combination. The target dimension filtering module is used to calculate the degree of influence of the candidate dimensions included in the dimension combination on the abnormal request parameters, and to filter out the target dimensions. The fluctuation value determination module includes: The rate of change detection unit is used to calculate the instantaneous rate of change of the abnormal request parameter under each candidate dimension in each unit time period within the target time period for each candidate dimension. The fluctuation value determination unit is used to calculate the variance of the instantaneous change rate of the abnormal request parameter under the alternative dimension within the target time period, and obtain the fluctuation value of the instantaneous change rate of the abnormal request parameter under the alternative dimension. The dimension combination determination module includes: The alternative combination determination unit is used to combine each of the alternative dimensions according to the level corresponding to each of the alternative dimensions to obtain at least one alternative combination; wherein, the number of alternative dimensions at the same level in the alternative combination is one; The dimension combination determination unit is used to determine the candidate combination as a dimension combination when the instantaneous rate of change fluctuation value of the abnormal request parameter under the candidate combination is greater than or equal to the fluctuation threshold.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the anomaly localization method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the anomaly localization method according to any one of claims 1-5.

Images